Everything you need to know about the Shellshock Bash bug

Post by zorpner » Thu, Sep 25, 2014, 2:28 PM UTC

embolalia wrote: post #17

ck2 wrote: post #12

Keep an eye on the patches directory for whatever version you use: http://ftp.gnu.org/pub/gnu/bash/ Just had to manually patch a CentOS4 legacy system. What I find interesting is the patch has been around since the 16th, what took so long and what finally lit a fire under the mainstream *nix releases?

>CentOS4 legacy system Jesus. That's been out of support for well over 2 years. I can't imagine this is the only problem it has. I'm curious: what's keeping the organization from upgrading it?

  $ uptime
   07:26:20 up 3280 days, 16:23,  2 users,  load average: 0.00, 0.00, 0.00
  $ cat /etc/issue
  Debian GNU/Linux 3.1 \n \l

Post by sillysaurus3 » Thu, Sep 25, 2014, 2:29 PM UTC

jgrahamc wrote: post #84

TeMPOraL wrote: post #65

Earlier quoted context omitted.

Thanks! EDIT after OP's edit. Sad. This situation feels kind of a disaster-relief thing; not a good time to think about monetizing it. Still, I do understand you don't want people thinking you'll always be protecting them from everything even if they don't pay. EDIT2 after clarification downthread, previous edit is to be disregarded.

It's less about trying to monetize it than about the cost to us of suddenly inspecting every request that goes through us. We service a huge volume of traffic and part of our core value is performance so keeping our processing latency is low as possible is important. (Note: I removed sentence about CloudFlare pricing from previous comment to avoid any confusion about monetization)

Post by muyuu » Thu, Sep 25, 2014, 2:30 PM UTC

billadoid wrote: post #10

jamroom wrote: post #2

From the article: "Of course one means of mitigating this particular attack vector is simply to disable any CGI functionality that makes calls to a shell" If you're on Ubuntu: a2dismod cgi service apache2 restart If you're NOT running any CGI scripts this will disable CGI support in Apache. Not sure if that takes care of things 100%, but might be helpful.

If you're on Ubuntu or Debian your CGI scripts will probably use dash, not bash.

Post by ninkendo » Thu, Sep 25, 2014, 2:31 PM UTC

donatj wrote: post #4

So trying to understand the issue here, is this actually a bash thing or a problem with the web server forwarding commands to bash? I don't understand why bash would be listening to network traffic on its own.

Post by mrfusion » Thu, Sep 25, 2014, 2:34 PM UTC

Maken wrote: post #90

diydsp wrote: post #80

Earlier quoted context omitted.

I think I have the same question.. why is this called a "bash" bug? Is it not a webserver bug? Why does the webserver send data to bash through environment variables? Is there no better way to do it?

If something, it's a bug in the CGI specification, since passing HTTP headers as environment variables is part of the standard.